Windows Defender Reports Trojan

[speed-of-heat]

I got this message this morning firing up DCS:

 

Threat Detected: Trojan:Win32/Wacatac.D!ml

 

Alert Level: Severe

 

Category: Trojan

 

Details: This program is dangerous and executes commands from an attacker

 

Affected items:

file: E:\Games\Eagle Dynamics\DCS World Openbeta\Mods\aircraft\F14\bin\F14-HeatblurCommon.dll

 

with a link for more info here https://go.microsoft.com/fwlink/?linkid=142185&name=Trojan:Win32/Wacatac.D!ml&threatid=2147749373

 

I'm guessing this is a false positive ... but do want to check with MS https://www.microsoft.com/en-us/wdsi/filesubmission

[dolfo]

Same, different file.

 

file: D:\DCS World OpenBeta\Mods\aircraft\AJS37\bin\AJS37-Avionics.dll

[Xtan]

So am I.

[draconus]

https://forums.eagle.ru/showpost.php?p=4305536&postcount=12

Solution for now is to whitelist (exclude from scanning) DCS folders in your AV software.

[speed-of-heat]

https://forums.eagle.ru/showpost.php?p=4305536&postcount=12

Solution for now is to whitelist (exclude from scanning) DCS folders in your AV software.

 

with respect, that's not a solution, that's a terrible idea. A solution would be for the company to submit its exe/dll/etc... into one of the major AV vendors for analysis ... and then it flow out to the ecosystem...

[Nightstalker]

Same

[captain_dalan]

Yep, had one too. Ended up misplaced in another sub-forum:

 

https://forums.eagle.ru/showthread.php?t=271271

[Shibbyland]

I agree with Speed-of-heat. It's the publisher's responsibility to make sure their product is not running into issues like this. Each to their own but I don't intend to turn off protections.

 

If Eagle Dynamics are aware of the issue, then they can submit the file to the affected AV provider and if it's assessed as safe, the AV provider will let it through. I wouldn't suggest turning off your AV just so you can play a game, even trusted publishers can be compromised by external parties.

[draconus]

I wouldn't suggest turning off your AV just so you can play a game, even trusted publishers can be compromised by external parties.

Even trusted AV companies can be compromised and the system you're running all of it on. You've been given the information. What you do with it is your choice. Afaik the stable version does not have this problem so there it is if you wish.

[Shibbyland]

As I said, each to their own. I have made my choice, I'm going with my AV. I've got two purchases I'm holding off on pending a resolution to this issue.

 

Hopefully ED submit the files causing the problem soon and if they're safe then the AV will let it through.

 

True about stable version but what happens when stable is updated to the open beta build and the AV picks up the files there?

[speed-of-heat]

Sorry Draconus, you are normally very helpful, in this case your advice is neither helpful , or accurate , and whilst its true everyone could be compromised, including AV vendors, thats akin to saying don't wear a seat belt because the manufacturing process is imperfect...

Edited April 29, 2020 by speed-of-heat

[draconus]

No one forces you turn off the AV. It's your rightful choice to wait for the better versions of both DCS and/or AV defs if you wish so. Hopefully the stable, when it comes, will have these problems sorted after ED is happy with the beta.

 

I just gave info on options to let anyone enjoy the working beta when troubles like these happen. Keep in mind there are hundreds of thousands players enjoying it including devs, content creators and popular youtubers.

The reason behind AV alarms is the copy protection changes ED uses in their code which trigger detecting potentialy suspicious actions. It's called false postitive and of course ED is working on it but that is beyond the HB's abilities for a fix now.

[speed-of-heat]

No one forces you turn off the AV. It's your rightful choice to wait for the better versions of both DCS and/or AV defs if you wish so. Hopefully the stable, when it comes, will have these problems sorted after ED is happy with the beta.

 

I just gave info on options to let anyone enjoy the working beta when troubles like these happen. Keep in mind there are hundreds of thousands players enjoying it including devs, content creators and popular youtubers.

The reason behind AV alarms is the copy protection changes ED uses in their code which trigger detecting potentialy suspicious actions. It's called false postitive and of course ED is working on it but that is beyond the HB's abilities for a fix now.

 

actually HB could just submit there dll's when they release them .... it took me about 10 mins to do it for you to Microsoft.. you are welcome

[Shibbyland]

Thanks Draconus, that's fair enough. I'm happy to wait.

 

I'm periodically attempting to re-download the beta (because the multiplayer is much more active on beta) in the hope ESET have made adjustments and it no longer detects an issue.

[Tsavong]

I had the same problem yesterday with AJS37-Avionics.dll but aftrer updating Windows Defender today it no longer flaged so I was able to download the AJS37 again.

[captain_dalan]

I have to agree, our job is to report a bug, dev's job to solve it.